COMPUTER MONITORING SYSTEM 



BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

The invention relates to a computer monitoring 
system for monitoring a computer and, more particularly to, 
a computer monitoring system which can monitor also a 
computer for its use efficiency and an illegal activity in 
e-mail transmission /reception, internet browsing, or 
software installation at it. 

2. Description of the Related Art 

There has also been available such a system that is 
provided with a function of monitoring a computer connected 
to a network. 

Such a system is disclosed in, for example, Japan 
Patent Application Laid-Open No. Hei 8-2 63283 "SOFTWARE 
MANAGER SYSTEM" (Applicant: Ricoh, Inventor: Hideki 
Kobayashi) publicized on Oct. 11 'th, 1996. 

This invention provides a software manager system 
which can easily maintain and manage software programs so 
that they may not be used illegally at a plurality of 
terminals connected to a communication means such as LAN. 

Such a prior art system, however, can only monitor a 
log of a monitor-subject computer and cannot actively decide 
a use efficiency and an illegal use of a monitor-subject 
computer, thus suffering from a problem that the monitoring 
functions cannot fully be utilized. 



SUMMARY OF THE INVENTION 
In view of the above, it is an object of the 
invention to provide a computer monitoring system which can 
monitor a monitor-subject computer to improve its use 
efficiency and also find illegal mail transmission/reception, 
browsing, etc. so far impossible to decide, thus promoting 
its appropriate use. 

To solve the problem of the above-mentioned prior 
art system, in a computer monitoring system according to the 
invention, a monitor-subject computer records a log of a use 
state of application software, which log is acquired from 
the monitor-subject computer by a monitor computer, which in 
turn calculates an application software-specific using time 
and a use rate except an idle state time as well as an idle 
state time and a use rate to thereby output a use efficiency, 
thus enabling measuring the use efficiency specific to the 
application software at that monitor-subject computer. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer can monitor 
a plurality of monitor-subject computers in duty posts to 
thereby acquire a log at these monitor-subject computers for 
each of the posts and then output an application software 
use efficiency specific to that post, thus measuring the - 
application software use efficiency for each of the posts. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer can acquire 



a log of characters input at a monitor-subject computer to 
thereby analyze whether the monitor-subject computer has 
created an illegal document, thus inhibiting illegal 
document creation to promote appropriate use at the monitor- 
subject computer. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer can acquire 
a log of the contents of a mail transmitted/received at a 
monitor-subject computer to thereby analyze whether the 
monitor-subject computer has transmitted or received a mail 
illegally, thus inhibiting illegal mail 

transmission/ reception to promote appropriate use at the 
monitor-subject computer. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer can acquire 
a log of a browsing operation of the internet by a monitor- 
subject computer to thereby analyze whether the monitor- 
subject computer has browsed it illegally, thus inhibiting 
illegal browsing to promote appropriate use at the monitor- 
subject computer. 

In the above-mentioned monitoring system according 
to the invention, the monitor computer can acquire a log of 
installation or un-installation operations of software, thus 
inhibiting illegal installation or un-installation of 
software to promote appropriate use at the monitor-subject 
computer. 

In the above-mentioned computer monitoring system 



according to the invention, the monitor computer can acquire 
a log of characters input at a monitor-subject computer and 
also calculate the number of these input characters to 
thereby calculate an input efficiency for a software using 
5 time at the monitor-subject computer, thus assessing the 

input efficiency of the user of the monitor-subject computer. 

In the computer monitoring system according to the 
invention, a monitor-subject computer holds a log of home 
page accesses, which log is acquired from the monitor- 

10 subject computer by the monitor computer, which then sums up 
times for accessing each home page for a specific summation 
duration and displays a list of the URLs or names of the 
home pages in a descending order of the access times, thus 
enabling knowing popular sites easily. 

15 in the computer monitoring system according to the 

invention, a monitor-subject computer holds a log of a use 
state of application software, which log is acquired from 
the monitor-subject computer by the monitor computer, which 
then calculates availability based on a ratio between an 

20 idle state time and an application software using time and 

displays a list of the monitor-subject computers in an order 
of the availability value, thus enabling easily knowing 
which one of the monitor-subject computers is high or low in 
availability . 

2 5 In the computer monitoring system according to the 

invention, a monitor-subject computer holds a log of site 
viewing operations , which log is acquired from the monitor- 
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subject computer by the monitor computer, which then sums up 
the numbers of viewing times or the viewing times for each 
of sites registered beforehand if that log relates to the 
site, to calculate a viewing rate based on thus calculated 
5 sum of the number of viewing times or the viewing times and 
display a list of the names of the monitor-subject computers 
in an order of the viewing rate, thus enabling easily 
knowing -a viewing rate of the monitor-subject computers at a 
specific site. 

10 In the computer monitoring system according to the 

invention, a monitor-subject computer holds a log of a use 
state of application software, which log is acquired from 
the monitor-subject computer by the monitor computer, which 
then sums up the numbers of using times or the using times 

15 for each application software product if that log relates to 
the application software product, to calculate a use rate 
based on thus calculated sum of the number of using times or 
the using times and display a list of the names of the 
monitor-subject computers in an ascending order of the use 

20 rate, thus enabling easily knowing the use rate of the 

monitor-subject computer for specific application software. 

In the computer monitoring system according to the 
invention, a monitor-subject computer holds a log of a use 
state of application software or accesses to a home page, 

25 while the monitor computer classifies the application 
software products used or the home pages accessed into 
specific items beforehand, so that the monitor computer, 
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when having acquired the log from the monitor-subject 
computer, calculates a using time and a viewing time for 
each classification and displays a list of the names of the 
monitor-subject computers based on a ratio of the specific 
5 items, thus enabling easily knowing the monitor-subject 
computer in an order of the ratio of the specific items. 

In the computer monitoring system according to the 
invention, a monitor-subject computer holds a log of 
characters input in use of application software, which log 

10 is acquired from the monitor-subject computer by the monitor 
computer, which then displays the input characters for each 
application software product, thus enabling easily knowing 
the input characters for each application software product. 

In the computer monitoring system according to the 

15 invention, a monitor-subject computer holds a log of a use 
state of application software, while the monitor computer 
registers the application software products by classifying 
them into categories beforehand, so that the monitor 
computer, when having acquired the log from the monitor- 

20 subject computer, sums up the using times both for each and 
for all of the categories and calculates the use rates for 
each of all the categories and then displays thus calculated 
use rates, thus enabling easily knowing the use rate for 
each category to which the application belongs as against 

25 all the categories. 

In the computer monitoring system according to the 
invention, a monitor-subject computer holds a log of a state 



of viewing a site, while the monitor computer registers the 
sites by classifying them into categories beforehand, so 
that the monitor computer, when having acquired the log from 
the monitor-subject computer, sums up the viewing times both 
5 for each and for all of the categories and calculates the 
viewing rate for a specific one of all the categories and 
then displays thus calculated viewing rate, thus enabling 
easily knowing the viewing rate for each category to which 
the site belongs as against all the categories. 

10 

BRIEF DESCRIPTION OF THE DRAWINGS 
FIG. 1 is a block diagram for showing a 
configuration of a computer monitoring system related to an 
embodiment of the invention; 
15 FIG. 2 is a schematic diagram for showing a screen at a 
monitor PCI in which a log of a monitor-subject PC 2 is 
shown; 

FIG. 3 is a schematic diagram for showing a display 
example of a use efficiency at the monitor-subject PC2; 
20 FIG. 4 is a configuration diagram for showing 

manager software used at the monitor PCI; 

FIG. 5 is a configuration diagram for showing 
monitor software used at the monitor-subject PC2; 

FIG. 6 is a flowchart for showing log acquisition in 
25 the manager software; 

FIG. 7 is a flowchart for showing data operation in 
the manager software; and 



FIG. 8 is a flowchart for showing log outputting in 
the monitor software. 



DESCRIPTION OF THE PREFERRED EMBODIMENTS 
5 The following will describe embodiments of the 

invention with reference to the drawings . 

In a computer monitoring system related to this 
embodiment of the invention, a monitor computer (monitor PC) 
can acquire a log of actions of a monitor-subject computer 
10 (monitor-subject PC) and also calculate its use efficiency- 
based on that log to then output and display it, 
particularly calculate an active time excluding an idle 
state time of a working application at the monitor-subject 
PC to measure a use efficiency of the application software 
15 at the monitor-subject PC, thus improving the use efficiency 
Furthermore, the computer monitoring system related 
to this embodiment of the invention monitors illegal e-mail 
transmission/reception or illegal browsing over the Internet 
thus promoting appropriate use of the computers over the 
2 0 network . 

The computer monitoring system (the present system) 
related to this embodiment of the invention is described 
with reference to FIG. 1 as follows. FIG. 1 is a block 
diagram for showing a configuration of the computer 
25 monitoring system related to this embodiment of the 
invention. 

The present system, in which a plurality of 
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computers is interconnected in a one-to-many, one-to-one, or 
many-to-one LAN configuration, comprises a monitor computer 
(monitor PC) 1 for monitoring, monitor-subject computers 
(monitor-subject PCs) 2a, 2b, and 2c to be monitored by the 
5 monitor PCI, and a LAN3 for interconnecting the monitor PCI 
and these monitor-subject PCs2 as shown in FIG. 1. 

In this figure, the LAN3 is shown as of wired 
connection but may be of wireless connection. 

Furthermore, generally, the monitor PCI may be 
10 considered to be utilized by a boss at a company or a 

teacher at a school, while the monitor-subject PCs2 may be 
considered to be utilized by his subordinates at the company 
of pupils at a school. 

The following will specifically describe those 
15 components in the present system. 

The monitor PCI is used to monitor the monitor- 
subject PCs 2 connected to the LAN . This PCI has managing 
software installed therein for monitoring for acquiring a 
new log of input characters etc. in addition to a usual log 
2 0 (record of actions and times) at the monitor-subject PCs 2 to 
thereby display their data in order to calculate and display 
the use efficiency of the monitor-subject PCs2 based on 
these usual logs and also detect illegal e-mail 
transmission/reception or illegal browsing based on that log 
25 of the characters etc. 

In this embodiment, as shown in FIG. 1, the monitor 
PCI monitors each of the plurality of monitor-subject PCs 2a, 
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2b, and 2c and also collectively monitors a plurality of 
monitor-subject PCs 2 in a specific group (duty post) to 
analyze a use state of applications for each specific group. 

How the monitor PCI monitors the PCs specifically is 
5 described later. 

The monitor-subject PCs 2 are connected to the LAN 3 
and have each installed therein monitor software monitored 
by the monitor PCI, to give such logs as follows using, for 
example, TELNET. 

10 The logs record applications' active and idle states, 

mail transmission/reception (mail contents acquired in 
texts), input characters (character data acquired in texts), 
software installation/un- installation, browsing over the 
Internet/ intranet , etc. Naturally, those logs have date and 

15 time acquired therein automatically. 

The LAN 3 , to which the monitor PCI and the monitor- 
subject PCs 2 a- 2c are connected, may come in of wired 
connection, wireless connection, or hybrid connection 
utilizing both connection types. 

20 Furthermore, the monitor PCI has the manager 

software installed therein and so has a right to monitor the 
monitor-subject PC2 in which the monitor software is 
installed but the monitor-subject PC2a has not right to 
monitor another monitor-sub ject PC2b. 

25 The following will describe the manager software and 

the monitor software used in the present system with 
reference with FIGS. 4 and 5. FIG. 4 shows a configuration 



diagram of the manager software and FIG. 5, a configuration 
diagram of the monitor software. 

As shown in FIG. 4, the manager software 21 
comprises a controlling means 22 , a log acquiring means 23, 
5 a log analyzing means 24, a data operating means 25, and a 
displaying means 26. 

As shown in FIG. 5, the monitor software 31, on the 
other hand, comprises a controlling means 32, a log 
outputting means 33, and a plurality of monitoring means 34. 
10 The following will specifically describe the 

configuration of these means of the manager software. 

The controlling means 22 is used to control each 
operation by the manager software 21. The controlling means 
22, for example, outputs a log acquire instruction to the 
15 monitor- subject PC2 via the LAN 3 and also outputs a data 

operate instruction relating to a log to the data operating 
means 25. Further, the controlling means 22 outputs to the 
displaying means 2 6 a display instruction for displaying a 
log acquired at the data acquiring means 23 or a data 
20 operation result calculated at the data operating means 25. 

In this case, the log acquire instruction may be 
output when a log acquire directive is input from a user of 
the monitor PCI or automatically at a constant time. 

The log acquiring means 23, in response to a log 
25 acquiring instruction from the controlling means 22, 

acquires a log output by the monitor-subject PC2 and stores 
it in a memory portion (not shown) of the monitor PCI. 
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The log analyzing means 24 analyzes the log stored 
in the memory portion, decides and classifies its type and 
then stores it in another area in the memory portion. 

The data operating means 25 uses the type-specific 
5 log classified and stored by the log analyzing means 24 to 
thereby calculate desired data based on a data operating 
instruction output by the controlling means 22 and store 
thus calculated data in another area in the memory portion. 

The displaying means 26 displays the type-specific 
10 log classified and stored by the log analyzing means 24 or 
the data operating result calculated by the data operating 
means 25 according to a displaying instruction from the 
controlling means 22. 

The following will specifically describe a 
15 configuration of each of those means of the monitoring 
software 31. 

The controlling means 32 is used to control each 
operation at the monitor software 31. The controlling means 
32 detects a log acquiring instruction output by the manager 

20 software 21 to then output a log outputting instruction to 
the log outputting means 33 . 

The log outputting means 33 summarizes various types 
of logs stored by each of the monitoring means 34 and 
transmits it to the monitor PCI based on the log acquiring 

25 instruction from the controlling means 32. Moreover, the 
log outputting means 33 deletes thus output logs from a 
memory portion (not shown) of the monitor-subject PC2 . 
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The plurality of monitoring means 34 is provided for 
each of monitor-subject applications such as applications 
and mails to thereby always monitor the corresponding 
monitor-subject application and store the monitoring result 
5 as a log in the memory portion of the monitor-subject PC2 . 

The following will describe monitoring processing at 
the present system with reference to FIGS. 2-8. FIG. 2 is a 
schematic diagram for showing a log displaying screen of the 
monitor-subject PC2 at the monitor PCI and FIG. 3 is a 
10 schematic diagram for showing a display example of the use 
efficiency at the monitor-subject PC2 . FIG. 6 is a flow 
chart for showing log acquisition at the manager software, 
FIG. 7 is a flowchart for showing a data operation at the 
manager software, and FIG. 8 is a flowchart for showing log 
15 outputting at the manager software. 

When the monitor PCI outputs via the LAN 3 to a 
specific monitor-subject PC2 a directive for acquiring a log, 
the monitor-subject PC2 transmits the recorded log via the 
LAN 3 to the monitor PCI. 
20 Specifically, first at the monitor PCI, the 

controlling means 32 of the manager software 21 outputs and 
transmits a log acquiring instruction to a specific monitor- 
subject PCI via the LAN3 . 

At the monitor-subject PC2 , the monitoring means 34 
25 provided for each monitor- sub ject application is always 
recording logs (see S31 of FIG. 8). 

When the log acquiring instruction is received by 



the monitor-subject PC2 ("YES" at S32 of FIG. 8), the 
controlling means 32 detects the log acquiring instruction 
to thereby output a log outputting instruction to the log 
outputting means 33). If the log acquiring instruction is 
not received ("NO" at S3 2 of FIG. 8), the monitor-subject 
PC 2 continues to record the logs . 

The log outputting means 33, based on the log 
outputting instruction, reads out logs recorded by each 
monitoring means 34 and outputs and transmits them 
collectively via the LAN 3 to the monitor PCI (S33 of FIG. 8). 
Thus read out logs are deleted from the memory portion by 
the log outputting means 34 (S34 of FIG. 8). 

Next, the monitor PCI acquires the logs transmitted 
from the monitor-sub ject PC 2 to then analyze thus acquired 
logs and classify them for each monitor subject or set item. 

Specifically, at the monitor PCI the log acquiring 
means 23 of the manager software 21 decides whether a log 
acquiring instruction has been output from the controlling 
means 22 (Sll of FIG. 6) and, if it decides so ("YES" at Sll 
of FIG. 6), acquires the transmitted log (S12 of FIG. 6). 
Thus acquired log is stored in the memory portion of the 
monitor PCI. 

Next, the log analyzing means 24 analyzes thus 
acquired logs to classify them for each monitor-subject 
application or set item and store them in the memory portion 
(S13 of FIG. 6). Since thus acquired logs are an aggregate 
of logs recorded by the plurality of monitoring means 34 at 
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the monitor software 31, they can be classified beforehand 
for each monitor- subject application or set item to thereby 
be summed up or displayed effectively, 

The log analyzing means 24 analyzes each of the 
5 acquired logs on which one of the monitor-subject 

applications each log concerns to thereby specify the log 
type and store the type-specific logs in the memory portion. 

Finally, the logs completely analyzed are displayed 
by the displaying means 26 (S14 of FIG 6). The following 
10 will describe how to display logs with reference to an 
example of the display screen. 

The monitor PCI displays an acquired log of the 
monitor-subject PC2 as shown in the display screen of FIG. 2. 

Specifically, the monitor PCI activates the manager 
15 software 21 to then permit the displaying means 25 to 
display a screen comprised of a calendar portion 11, a 
connected state displaying portion 12, and a log displaying 
portion 13 . 

Just when the manager software has been activated, 
2 0 however, no monitor-subject PC2 is specified, so that no 
contents are displayed at the log displaying portion 13 . 

In the state where the monitor-subject logs are 
completely acquired and classified by the above-mentioned 
method, when a monitor-subject PC2 is specified by 
25 referencing the connected state displaying portion 12 on the 
display screen of the monitor PCI, the controlling means 22 
outputs a displaying instruction to the displaying means 26. 
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The displaying instruction in this case contains information 
such as log types and orders to be displayed. The 
displaying means 26, based on the displaying instruction, 
displays the log contents of that monitor-subject PC2 at the 
log displaying portion 13 . 

The displaying means 25 displays classified logs, so 
that if, for example, no new log is acquired ("NO" at Sll of 
FIG. 6), it displays acquired and classified logs stored in 
the memory portion. 

The log contents displayed at the log displaying 
portion 13 include an event type, a date, and a parameter, 
the event type of which contains "character inputting". 

Although not shown in FIG. 2, a mail 
transmission/reception log, a software installation/un- 
installation log, and a browsing log are included in the 
acquired logs . 

Therefore, the monitor PCI can acquire from the 
monitor-subject PC2 input characters in texts or main 
transmission/reception contents in texts, so that by 
analyzing these texts, it can check for illegal document 
creation or illegal mail transmission/reception. 

Furthermore, the monitor PCI can acquire the 
monitor-subject PC2 software installation/un- installation 
from the log, so that it can check for illegal software 
installation or legal software un-installation. 

Moreover, the monitor PCI can acquire characters 
input from the monitor-subject PC2 in texts, so that even 
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with application software such as tag software, the 
character contents can be analyzed because it acquire 
character texts input. 

In addition, the monitor PCI acquires a browsing log 
5 from the monitor-subject PC2, so that it can check on 

whether a regular home page defined beforehand is being 
accessed. 

In the display screen shown in FIG. 2, when a 
monitor- subject PC 2 is specified by referencing the 

10 connected state displaying portion 12 when acquisition and 
classification of logs from the monitor-subject PC2 is not 
completed yet, the manager software 21 may perform, in 
specifications, this log acquisition and classification to 
display the log on the display screen. 

15 Further, the monitor PCI calculates the use 

efficiency of each application software product based on the 
log contents shown in FIG. 2. 

In the display screen shown in FIG. 2, when a 
directive is input for calculating and displaying a use 

2 0 efficiency, it is displayed as shown in FIG. 3. 

Specifically, when the directive for calculation and 
displaying of the use efficiency is input, the controlling 
means 22 of the manager software 21 outputs a data operating 
instruction to the data operating means 25. The data 

25 operating means 25 detects the data operating instruction 
( "YES" at S21 of FIG. 7) to then use classified logs, thus 
performing operations for obtaining data of the use 



efficiency (S22 of FIG. 7). Finally, the controlling means 
22 outputs a displaying instruction to the displaying means 
26 , in response to which the displaying means 26 displays 
the data of the use efficiency on the display screen (S23 of 
5 FIG. 7). 

In FIG. 3, the using time and the use rate are 
calculated and displayed for the application contents. 

As the using time for each application, a time 
actually used except an idle state time at the application 
10 is calculated. 

Specifically, the using time is measured from the 
time when that application is activated up to the completion 
of that application which is subtracted by a time ( idle 
state time) from a time point when, for example, five 
15 minutes have passed from an action such as the activation or 
a character inputting up to the next action. That is, the 
using time refers to an essential application using time. 

Note here that in FIG. 3 the idle state is displayed 
as "IDLE" . 

20 Furthermore, the use rate is calculated and 

displayed in percentage of use in all application products 

and idle states . 

The figure shows the using time and the use rate of 

the day but may show them as summed up for each week or 
25 month. In this case, the monitor PCI needs to record logs 

of the summed up times in the memory portion. 

i 

Furthermore, it not only can manage utilization of 
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PCs by an individual but also can sum up and display the 
utilization states of the applications for each department 
such as the accounting department, the designing department, 
or the business department. 
5 Specifically, by calculating a using order or an 

average of applications for each duty post, it is possible 
to promote improvements in business operations at each 
department . 

For example, if a summing result at the designing 
10 department indicates that the use of a table calculating 
application is larger in amount than the use of a CAD 
application for designing, it means that a job such as 
estimating at the designing department is larger in amount 
than designing, so that it is possible to suggest that the 
15 job of this estimating should be shifted to other 
departments . 

Furthermore, the monitor PCI can acquire the number 
of input characters from a character inputting log at the 
monitor-subject PC2 to thereby calculate an inputting 

2 0 efficiency based on the number of input characters during 
the using time of the application. This enables measuring 
an inputting efficiency of a user of the monitor- subject PC2 
to thereby contribute to better personnel administration. 

In addition, if a personal computer is always in a 

25 power-ON state over an intranet of a company, an idle state 
time is prolonged, in which case the application use 
efficiency is calculated and displayed in a network- 
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connected time with respect to a log-off time. 

The above-mentioned efficiencies can be calculated 
by outputting from the controlling means 22 to the data 
operating means 25 a data operating instruction for 
5 calculating the corresponding efficiency value. 

Since the computer monitoring system (the present 
system) according to this embodiment of the invention 
permits the monitor PCI to acquire a log at the monitor- 
subject PCs2 to thereby calculate and display the use 
10 efficiency of each application, it is possible to easily 

decide whether the application is properly and effectively 
used at each monitor-subject PC2 , thus contributing to 
promotion of better business operations at these monitor- 
subject PCs 2. 

15 Furthermore, since the present system permits the 

monitor PCI to sum up the use states of application software 
at each duty post from a log at each monitor-subject PC2, it 
is possible to decide whether the application software is 
used properly at each department, thus easily improving the 

20 business operations. 

Moreover, the present system permits the monitor PCI 
to acquire the contents of mail transmission/reception at 
the monitor-subject PC2, it is possible to easily analyze 
the mail contents, thus contributing to elimination of 

25 illegal main transmission/ reception. 

Additionally, the present system permits the monitor 
PCI to know a browsing log and a home page viewing time at 



the monitor-subject PC2, thus contributing to elimination of 

illegal browsing over the Internet. 

Furthermore, the present system permits the monitor 

PCI to acquire a log of software installation/un- 

installation at the monitor-subject PC2, thus contributing 

to promotion of proper software installation. 

The following will describe first through eighth 

examples of other utilization methods in the present system. 
The first utilization method is displaying of a 

"list of popular sites". The monitor-subject computers 

(monitor-subject PCs) are used as an individual computer, a 

duty spot computer, and an overall computer, using a day, 
week, month, or year as a unit of summation duration, to 

display a list of home pages in an access time order. 

Specifically, the monitor-subject PCs hold logs 
relating to home page (site) accesses, while the monitor 
computer (monitor PC) acquires and classifies the logs 
relating to the home page accesses at the monitor-subject 
PCs from each of them and then store these logs in the 
memory portion. 

Then, the manager software 21 at the monitor PC 
causes the controlling means 22 to output to the data 
operating means 25 a data operating instruction for 
accumulating (summing up) access times for each accessed 
home page in units of the summation duration value so that 
the data operation may be performed. Moreover, the 
controlling means 22 outputs to the displaying means 26 a 
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display instruction for displaying a list of the URLs or the 
names of the home pages in an ascending order of thus 
accumulated access times so that they may be displayed. 
This enables easily knowing popular sites in 
5 business operations. 

The second utilization method is displaying of a 
"working-rate order list of PCs (employees)". The monitor- 
subject PCs are used as a duty spot computer and an overall 
computer, using a day, week, month, or year as a unit of the 
10 summation duration, to display a list of PCs with a low or 
high use rate based on a ration between an idle state time 
and a usual business time. 

Specifically, the monitor-subject PCs hold logs of 
use states of business applications, while the monitor PC 
15 acquires from each of the monitor-subject PCs the logs of 

the use states of the business application software at them 
and classifies them and then stores them in the memory 
portion. 

Then, a data operating instruction is output from 
2 0 the controlling means 22 to the data operating means 25 for 
accumulating, in the manager software 21 of the monitor PC, 
idle state times and using times of usual business for each 
of the monitor-subject PCs to thereby calculate "working 
rate (use rate) = (usual business using time) /(idle state 
25 time)" so that the operation may be performed. Moreover, 

the controlling means 22 outputs to the displaying means 2 6 
a displaying instruction for displaying a list of the names 



of the monitor-subject PCs in an order of the working rate 
so that the list may be displayed. 

This enables easily knowing PCs having a high or low 
working rate. 

5 The third utilization method is displaying of a 

"list of site (category) specific PCs (employees". The 
monitor-subject PCs are used as a duty spot computer and an 
overall computer, using a day, week, month, or year as a 
unit of the summation duration to display a list of the PCs 
10 in an order of the viewing rate of a specific site 
(category) . 

Specifically, the monitor PC sets beforehand a site 
belonging to a specific site or category, to acquire from 
each of the monitor-subject PCs the log of the sites 

15 accessed at them and classify them and then store them in 
the memory portion. 

Then, in the manager software 21 of the monitor PC, 
the controlling means 22 and the data operating means 25 
calculate the number of viewing times and the viewing times 

20 for thus set sites and, based on thus calculated values of 

the number of viewing times and the viewing times , calculate 
the viewing rate for a specific site using as a denominator 
the number of viewing times or the viewing time for all of 
the set sites. Then, the controlling means 22 and the 

25 displaying means 26 display a list of the names of the 

monitor-subject PCs in an ascending or descending order of 
the viewing rate of the specific site. 



This enables easily knowing the viewing rate of each 
of the monitor-subject PCs at a specific site (category) . 

The fourth utilization method is displaying of a 
"list of application (category) specific PCs (employees)". 
5 The monitor-subject PCs are used as a duty spot computer and 
an overall computer, using a day, week, month, or year as a 
unit of the summation duration to display a list of the PCs 
in an order of the viewing rate of a specific application 
(category) . 

10 Specifically, the monitor-subject PCs hold logs of 

an application, while the monitor PC sets beforehand the 
application belonging to a specific application or category, 
to acquire the logs of the application used at each of the 
monitor-subject PCs from them and classify them and then 

15 store them in the memory portion. 

In the manager software 21 of the monitor PC, the 
controlling means 22 and the data operating means 25 
calculate the number of using times and the using times for 
a set application and, based on thus calculated values of 

2 0 the number of using times and the using times, calculate the 
use rate of a specific application using as the denominator 
the number of using times and the using time for all of the 
set applications. Then, the controlling means 22 and the 
displaying means 26 display a list of the names of the 

2 5 monitor-subject PCs in an ascending or descending order of 
the use rate. 

This enables easily knowing the use rate of each of 



the monitor-subject PCs for a specific application 
(category) . 

The fifth utilization method is displaying of a 
"working-rate order list of PCs (employees)". The monitor- 
5 subject PCs are used as a duty spot computer and an overall 
computer and uses a day, week, month, or year as a unit of 
the summation duration and make setting of business or 
recreation in an application and a home page beforehand for 
classification into four items of "business", "recreation", 

10 "idle", and "unclear" on the basis of the application using 
time and the site visiting time. A ratio among those 
classified items is used to display a list of the PCs. 

Specifically, the monitor PC makes the above- 
mentioned item classification at the application, site, etc. 

15 beforehand to thereby acquire from each of the monitor- 
subject PCs the logs of the application used at them and the 
viewed sites and classify these logs and then store them in 
the memory portion. 

In the manager software 21 of the monitor PC, the 

2 0 controlling means 22 and the data operating means 25 

calculate the using time and the viewing time for each item 
and also calculates the working rate = (total time of 
"business" classification) / (total time of all 
classifications) for each of the monitor-subject PCs. Then, 

25 the controlling means 22 and the displaying means 2 6 display 
a list of the names of the monitor-subject PCs in an 
ascending or descending order of the working rate. It is 
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also possible to obtain "recreation rate", "idle rate", and 
"unclear rate" . 

This enables easily knowing the order of the working 
rates (rates of specific items). 
5 The sixth utilization method is displaying of a 

"list of application-specific input characters." The 
monitor-subject PCs are used as an individual's computer, 
using a day as a unit of the summation duration to display 
input characters for each application. 

10 Specifically, the monitor PC acquires and classifies 

the input character logs of the monitor-subject PCs 
according to the above-mentioned method and holds the input 
characters corresponding to the application in the memory 
portion. Then, the controlling means 22 and the displaying 

15 means 25 select and read in the input characters for each 
application to thereby display a list of the input 
characters for each application. 

In contrast to the prior art method of displaying 
the characters for all the applications, this method enables 

20 easily knowing the contents of the characters for each of 
the applications . 

The seventh utilization method is displaying of a 
"application category use rate". The monitor-subject PCs 
are used as an individual's computer, a duty post computer, 

25 and an overall computer and use a day, week, month, or year 
as a unit of the summation duration, and registers a 
category in a application beforehand to thereby sum up its 
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use rates and display it for each category. In contrast to 
the prior art method of summing up the use rates for a 
specific word processor application, this method sums up the 
use rates for a category of the word processor software. 
5 Specifically, the monitor PC classifies and sets 

applications into categories beforehand, so that the 
controlling means 22 and the data operating means 25 
accumulate the using times for each category based on the 
logs of the use states of the applications classified after 

10 being acquired from each of the monitor-subject PCs to 
thereby obtain the application category use rate = 
(accumulated using times for each category )/( accumulated 
using times for all categories), which is then displayed by 
the controlling means 22 and the displaying means 26. 

15 This enables easily knowing the use rate of each 

category to which an application belongs with respect to 
that of all the categories . 

The eighth utilization method is displaying of a 
"site category viewing rate". The monitor-subject PCs are 

20 used as an individual's computer, a duty spot computer, and 
an overall computer and uses a day, week, month, or year as 
a unit of the summation duration and registers a category 
for each URL to thereby a category-specific viewing rate. 

In contrast to the prior art method of telling which 

2 5 page and how long is viewed, this method summarizes A 

retrieval sites and B retrieval sites into one retrieval 
site and display it. 



Specifically, the monitor PC sets categories as set 
for URLs beforehand to thereby acquire and classify the logs 
of site viewing for each of the monitor- subject PCs, so that 
the controlling means 22 and the data operating means 25 
5 accumulate the viewing times for each of the categories to 

obtain the site category viewing rate = (accumulated viewing 
time for each category )/( accumulated viewing time for all 
categories ) , which is then displayed by the controlling 
means 22 and the displaying means 26. 

10 This enables easily knowing the viewing rate for 

each category to which the site belongs with respect to that 
for all the categories . 

In the computer monitoring system according to the 
invention, monitor-subject computers hold a log of a use 

15 state of the application software, which log is acquired 

from them by the monitor computer, which then calculates the 
using time and the use rate for each application software 
product except an idle state time and the idle state time 
and the use rate and output the use rates, to thereby enable 

20 not only acquiring the log of the monitor-subject computer 
but also measuring the use rate for each application 
software product at that monitor-subject computer, thus 
contributing to promotion of the proper use of the 
application software at the monitor-subject computers. 

2 5 In the above-mentioned computer monitoring system 

according to the invention, the monitor computer can monitor 
a plurality of monitor-subject computers to thereby acquire 
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logs at these monitor-subject computers in duty spots for 
each of them and output the use rate of the application 
software for that duty spot, thus, contributing to 
improvement of the business operations for each of the duty 
5 spots . 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer acquires 
logs of input characters monitor-subject computers to 
analyze whether any one of these monitor-computers has 

10 created a document illegally, in order to inhibit illegal 

document creation, thus contributing to promoting of proper 
use at the monitor-subject computers. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer acquires 

15 logs of the contents of mail transmission/reception at 

monitor-subject computers to thereby analyze whether any one 
of these monitor-subject computers has transmitted or 
received a mail illegally, in order to inhibit illegal mail 
transmission/reception, thus contributing to promotion of 

20 proper use at the monitor-subject computers. 

In the above-mentioned computer monitoring system 
according to the invention, the monitor computer acquires 
logs of browsing over the Internet by monitor-subject 
computers to thereby analyze whether any one of these 

25 monitor-subject computers has browsed illegally, in order to 
inhibit illegal browsing, thus contributing to promotion of 
proper use at the monitor-subject computers. 
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In the above-mentioned computer monitoring system 
according to the invention, the monitor computer acquires 
logs of installation/un-installation of software at monitor- 
subject computers to thereby analyze whether the software 
5 has been installed or un-installed at any one of these 
monitor-subject computers, in order to inhibit illegal 
installation/un-installation of the software, thus 
contributing to promotion of proper use at the monitor- 
subject computers. 

10 In the above-mentioned computer monitoring system 

according to the invention, the monitor computer acquires 
logs of input characters at monitor-subject computers and 
also calculates the number of the input characters to 
thereby calculate the input efficiency for the software 

15 using time at the monitor-subject computers, in order to 
evaluate the input efficiency of the user of the monitor- 
subject computers, thus contributing to better personnel 
administration . 

In the computer monitoring system according to the 

20 invention, monitor-subject computers hold logs of home page 
accesses, which logs are acquired from them by the monitor 
computer, which sums up the access times for each home page 
for a specific summation duration, in order to display a 
list of the URLs or names of the home pages in a descending 

25 order of the access times, thus enabling easily knowing 
popular sites. 

In the computer monitoring system according to the 



invention, monitor-subject computers hold logs of use states 
of application software, which logs are acquired from them 
by the monitor computer, which calculates a working rate 
based on a ratio between an idle state time and the 
application soft using time, in order to display a list of 
the names of the monitor-subject computers in the order of 
the working rate, thus enabling easily knowing the monitor- 
subject computers having a high or low working rate. 

In the computer monitoring system according to the 
invention, monitor-subject computers hold logs of site 
viewing, which logs are acquired from them by the monitor 
computer, so that if any one of the logs relates to a site 
registered beforehand, the monitor computer sums up the 
numbers of viewing times or the viewing times for each site 
to calculate a viewing rate based on thus calculated value 
of the number of the time, in order to display a list of the 
URLs or names of the sites in the order of the viewing rate, 
thus enabling easily knowing the viewing rate of the 
monitor-subject computers at a specific site. 

In the computer monitoring system according to the 
invention, monitor-subject computers hold logs of the use 
state of application software, which log is acquired from 
them by the monitor computer, so that if any of the logs 
relates to application software products registered 
beforehand, the monitor computer sums up the numbers of 
using times or the using times for each of the application 
software products to thereby calculate the use rate based on 
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thus calculated value of the times or the time, in order to 
display a list of the names of the monitor-subject computers 
in the order of the use rate, thus enabling easily knowing 
the use rate of the monitor-subject computers in a specific 
5 application software product. 

In the computer monitoring system according to the 
invention, monitor-subject computers hold logs of the use 
state or the home page access for application software, 
while the monitor computer classifies beforehand the, 

10 application software products or homes pages accessed into 
specific items, so that the monitor computer, when having 
acquired the logs from the monitor-subject computers, 
calculates the using time and the viewing time for each 
classification, in order to display a list of the names of 

15 the monitor-subject computers based on a ratio among the 
specific items, thus enabling easily knowing the monitor- 
subject computers having in the order of the ratio among the 
specific items. 

In the computer monitoring system according to the 

20 invention, monitor-subject computers hold logs of characters 
input when application software is being used, which logs 
are acquired from them by the monitor computer, which in 
turn displays the input characters for each of the 
application software products, thus enabling easily knowing 

25 the input characters for each of the application software 
products . 

In the computer monitoring system according to the 
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invention, monitor-subject computers hold logs of the use 
state of application software, while the monitor computer 
classifies the application software products into categories 
and registers them beforehand, so that when having acquired 
5 the logs from the monitor-subject computers, the monitor 

computer sums up the using times both for each category and 
all of the categories to thereby calculate the use rate of a 
specific one with respect to that of all the categories, in 
order to display that use rate, thus enabling easily knowing 
10 the use rate of each category to which the relevant 
application relates with respect to that of the all 
categories . 

In the computer monitoring system according to the 
invention, monitor-subject computers hold logs of the 

15 viewing state for sites, while the monitor computer 

classifies the sites into categories and registers them 
beforehand, so that when having acquired the logs from the 
monitor-subject computers, the monitor computer sums up the 
viewing times both for each category and for all the 

20 categories to thereby calculate the viewing rate of a 

specific category with respect to that of the all categories, 
in order to display that viewing rate, thus enabling easily 
knowing the viewing rate of each category to which the 
relevant site belongs with respect to that of all the 

25 categories. 



